Issues with multi-stack access with appstream 2.0

Question

Hi,
I’m currently working on enabling Single Sign-On (SSO) through an Enterprise Application configured in Entra ID for multiple Amazon AppStream stacks.

I first followed this guide https://aws.amazon.com/blogs/desktop-and-application-streaming/enabling-federation-with-azure-ad-single-sign-on-and-amazon-appstream-2-0/, which correctly guided me into getting a single stack to work properly with SSO.

Now, I’m trying to extend this setup to support multiple stacks under the same Enterprise Application. I used the following video as a reference for multi-stack configuration: https://www.youtube.com/watch?v=-z33U1pNlEU

However, I’m encountering a problem. Here are the details:

I updated the IAM role policy that previously worked for one stack to include multiple stacks (the multiple 1 are just a censored version of my AWS ID account) 
```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "appstream:Stream",
            "Resource": [
                "arn:aws:appstream:ca-central-1:111111111111:stack/Stack-Lab1",
                "arn:aws:appstream:ca-central-1:111111111111:stack/Stack-Lab2"
            ],
            "Condition": {
                "StringEquals": {
                    "appstream:userID": "${saml:sub}"
                }
            }
        }
    ]
}
```
And under my Enterprise application on Entra ID I modified the Relay State from this :   
`https://appstream2.ca-central-1.aws.amazon.com/saml?accountId=111111111111&stack=Stack-Lab1`   
to this   
`https://appstream2.ca-central-1.aws.amazon.com/saml?accountId=111111111111`

When I try to connect through the Enterprise Application, I receive the following error: `Unable to authorize the session. (Error Code: INVALID_AUTH_POLICY);Status Code:401`

I also tried using a wildcard in the policy:
`arn:aws:appstream:ca-central-1:111111111111:stack/*`
but then I get:
`There are no catalogs available. Contact your IT administrator for help.`

Is there something I’m missing in the configuration? Any guidance or best practices for enabling SSO across multiple AppStream stacks under a single Entra ID Enterprise Application would be greatly appreciated.

Thank you very much and have a great day.

re:Post Agent · Answer

There are a few issues with your configuration that could be causing the errors you're experiencing:

1. In your IAM policy, there's a case sensitivity issue. The condition should be "appstream:userId" (with a lowercase 'd') instead of "appstream:userID" (with an uppercase 'D'). This mismatch could be causing the "INVALID_AUTH_POLICY" error.

2. When removing the specific stack from the relay state URL, you need to ensure that your IdP is properly configured to handle multiple stacks. Without specifying a stack in the relay state, AppStream 2.0 needs another way to determine which stack to present to the user.

For a multi-stack configuration, you have two main options:

Option 1: Create separate applications in your IdP (Entra ID) for each stack, each with its own relay state URL pointing to a specific stack. This gives users the ability to choose which application/stack they want to access.

Option 2: Keep a single application but implement a catalog selection page. For this to work, you need to:
- Keep the relay state without a specific stack as you've done
- Ensure your IAM policy correctly grants access to all stacks (with the correct case for userId)
- Configure your stacks to be visible in the catalog

If you're still experiencing issues after fixing the case sensitivity in your policy, you might want to check:
- That all stacks are properly configured and in the "Running" state
- That the user attributes in SAML are being passed correctly
- That there are no additional conditions in your trust policy that might be causing authentication failures

For disaster recovery or geographic distribution purposes, you can also set up multiple stacks across different regions and control access through the relay state URL or by configuring multiple applications in your IdP.  
**Sources**  
[AppStream 2.0 Unable to authorize the session. (Error Code: INVALID_AUTH_POLICY);Status Code:401 | AWS re:Post](https://repost.aws/questions/QU9ssjp0sWTgurUAY4UNHfxg/appstream-2-0-unable-to-authorize-the-session-error-code-invalid-auth-policy-status-code-401)  
[Disaster recovery - Best Practices for Deploying Amazon AppStream 2.0](https://docs.aws.amazon.com/whitepapers/latest/best-practices-for-deploying-amazon-appstream-2/disaster-recovery.html)

Issues with multi-stack access with appstream 2.0

Add your answer

Relevant content